For example, in a multiple redundancy configuration in a safety controller for a railway disclosed in JP 2000-255431 A, a failsafe function can be ensured using a plurality of control systems to improve its reliability. Each of control systems carries out comparison between one's own system and other system using a common memory with respect to input/output results of a signal to/from an on-site device. When the result data disagree with each other, each of the control systems judges that a failure has occurred and causes running of trains on railways to stop.
More specifically, for a certain input contact signal, input results in one's own system (hereinafter referred to as “a system A”) and input results in other system (hereinafter referred to as “a system B”) are compared with each other as follows. A controller of the system A reads out an input contact signal from an input unit of the system A and writes read-out results to the common memory. On the other hand, a controller of the system B, similarly, reads out an input contact signal from an input unit of the system B and writes read-out results to the common memory.
The controller of the system A reads out, from the common memory, the results which the controller of the system B has written, compares the results thus read out with its input results which have been read out from the input unit of the system A, and then carries out comparison with respect to input results between one's own system and other system.
However, the related art involves the following problems. In the conventional multiple redundancy configuration, when obtaining the input results of other system, the controller of one's own system reads out other system read-out results which have been written to the common memory by the controller of other system. With such a configuration, a circuit configuration for realization of a multiple system becomes complicated. Moreover, the complexity of the circuit configuration results in that the data processing becomes complicated, and hence there arises a problem in that an operation speed becomes slow, or the read-out results are delayed. Furthermore, there is encountered a problem in that the system becomes expensive since a dedicated hardware is required.
In addition, in the conventional multiple redundancy configuration, each of the control systems reads out a contact signal obtained through a relay circuit to carry out the comparison and the verification of an ON/OFF state of the contact signal. However, for example, when an encoder is used as signal detecting means, a signal which continuously changes its ON/OFF state is inputted to each of the control systems. As a result, there is encountered a problem in that each of the conventional control systems cannot carry out the comparison and the verification for counting results of such input signals.